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Abstract. In this paper we describe a generalisation and adaptation of Kedlaya's algorithm for 
computing the zeta function of a hyperelliptic curve over a finite field of odd characteristic that 
the author used for the implementation of the algorithm in the Magma library. We generalise 
the algorithm to the case of an even degree model. We also analyse the adaptation of working 
with the x^dxly'^ rather than the x^dx/y differential basis. This basis has the computational 
. advantage of always leading to an integral transformation matrix whereas the latter fails to 

' in small genus cases. There are some theoretical subtleties that arise in the even degree case 

where the two differential bases actually lead to different redundant eigenvalues that must be 
discarded. 
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1. Introduction 



(— I \ Kedlaya's algorithm for hyperelliptic curves in odd characteristic was one of the first practical 

I computational algorithms for computing the zeta function of a curve of genus greater than 1 over 

a large finite field of small characteristic [Ked01| . [Ked04] . It was generalised by Denef and 
Vercauteren to characteristic two |DV06b] and has also been extended to more general curves 
' like Cab curves ID V06 a1 . Kedlaya's algorithm is based on the calculation of the Frobenius 

\^ • action on an appropriate p-adic cohomology group that can be described in sufficiently concrete 

O ■ terms for explicit computer computations to be made. In the hyperelliptic case, Kedlaya used 

T^lj- ' Monsky-Washnitzer cohomology on the open affine subset of the curve defined by the removal 

\^ • of all Weierstrass points. 

. In 2003, the author wrote the implementation of Kedlaya's algorithm in the standard user 

library of the Magma computer algebra system [BCP97] . In practical terms, there appeared 
to be two issues with the algorithm as it stood. 
^ , Firstly, it only covered the odd degree case of a hyperelliptic model with a single point at 

infinity. Following Kedlaya's analysis, we extended the algorithm in a natural way to also 
cover the even degree case. The extension is fairly straightforward and the algorithm runs as 
before except that a degree one term has to be removed from the final characteristic polynomial 
corresponding to an extra eigenvalue q (the field size) arising from the extra point at infinity 
removed from the complete curve. 

More seriously, if p, the characteristic of the base finite field Eg, is small compared to the genus 
g of the hyperelliptic curve C - specifically if p < 2^ — 1 in the odd degree case and p < g in the 
even degree case - then the matrix M representing the fi-linear transformation of p-Frobenius 
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on Kedlaya's chosen differential basis of cohomology is non-integral. That is, the integral lattice 
generated by the basis is not stable under Frobenius. Because M has to be a-powered to a 
large degree to get to the final result, this presents obvious p-adic precision problems. If M 
represented a linear transformation, it could be easily replaced by an integral conjugate before 
powering (though then the characteristic polynomial of the power could be computed without 
matrix powering, anyway!), but the semi- linear situation is not so easy to work with. This issue 
is remarked upon in |Ked03j and can be dealt with in a number of ways. One approach is to try 
to analyse the situation using high-powered techniques like crystalline cohomology (or general 
F-module theory) to find an integral lattice to work with that is invariant under Frobenius. For 
example, Edixhoven gives a general criterion for stability under Frobenius of a sub Zp-module 
L of the Zp-module of differentials generated by Kedlaya's differential basis in Prop. 5.3.1 
of [Edi06j . A full proof of the criterion can be found in jvdBOSj . See also jCDV06] . which is 
described further below, for more general plane curves. 

In this very concrete situation, however, we computed that a slightly different differential 
basis for the minus part of the cohomology always works: namely differentials of the form 
x^dx/y^ rather than x^dx/y. The computation is again straightforward but, as far as we are 
aware, it has not appeared in detail before in the literature so, for completeness, we will show 
that Kedlaya's reduction process applied to this space of differentials always leads to an integral 
matrix M. 

The interesting technical point is that the differentials only form a basis for the minus part 
of the cohomology in the odd degree case. In the even degree case, the map from this space 
of differentials into H\ actually has a 1-dimensional kernel and cokernel. It turns out that the 
kernel has eigenvalue 1 and cokernel eigenvalue q under g-Frobenius, so in this case we have 
to remove a factor of t — 1 rather than t — q from the final characteristic polynomial. This is 
demonstrated in the final section of the paper. 

In summary, in the even degree case, one additional eigenvalue of Frobenius occurs on the 
affine Monsky-Washnitzer cohomology because of the additional point removed at infinity. This 
merely has to be removed at the end in order to get the numerator of the zeta function. Our 
alternative set of differentials generate a Zp-module V with Frobenius action. This space gen- 
uinely gives an F-stable lattice in H}_ for odd degree and the algorithm goes through as before, 
except with guaranteed p-integral matrices. For even degree, V also gives p-integrality but V®Q, 
doesn't quite coincide with i^l as a Frobenius module. However, an explicit analysis in this 
case shows that the difference between V and ffl results in just having to remove a different 
additional eigenvalue at the end. 

A very general Kedlaya-style algorithm applying to non-degenerate plane curves is presented 
by Castryck, Denef and Vercauteren in |CDV06] . There, a deterministic algorithm is given 
where a basis for cohomology is determined and an integrality analysis is performed involving 
Edixhoven's criterion and consideration of the Newton polygon of the curve. The hyperelliptic 
case, however, with its particular choices of differential bases, is still an important special case 
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amenable to the specific original analysis of Kedlaya and that presented here, and I have had 
requests from a number of people to publish details of the Magma implementation. 

We should also mention some of the other point-counting methods which have been developed 
over the last decade for curves of genus greater than 1 and that use different techniques to that 
of Kedlaya. 

Generalising the elliptic curve case, Mestre devised an algorithm for ordinary hyperelliptic 
curves in characteristic 2 based on the theory of the canonical lift. This computes a 2-adic 
approximation of a particular function of the eigenvalues of Probenius from which a finite num- 
ber of possibilities for the characteristic polynomial of Frobenius can be obtained by rational 
reconstruction in many cases (e.g. when the Jacobian is irreducible). Again generalising their 
algorithm for the genus 1 case, Lercier and Lubicz found a way to efficiently effect the lifting 
stage to obtain a quasi-quadratic algorithm jLL06j . The author implemented this algorithm 
for the standard MAGMA user library. Following the work of Robert Carls on theta structures 
of canonical lifts |Car07j . Carls and Lubicz have generalised the algorithm to odd characteris- 
tic |CL09j . 

Another important p-adic method is the deformation method of Lauder and Wan |LW08j . 
This generalises from the curve case to higher-dimensional hypersurfaces and provides the basis 
for the computation of zeta- functions of fairly general varieties over finite fields. The ideas go 
back to Dwork and use his approach to p-adic cohomology theory, working with parametrised 
families of hypersurfaces and continuously deforming to ones of special form (diagonal in Dwork's 
original work). R. Gerkmann has further studied the method, considering relations to rigid 
cohomology and practical p-adic precision analysis [Ger07] . He has written an implementation 
in Magma. Fuller details for the deformation method in the particular case of hyperelliptic 
curves have been worked out by H. Hubrechts |Hub08| who provided the implementation that 
appears in the standard Magma user library. 

A brief outline of the paper is as follows. In the next section, we introduce basic notation, 
summarise Kedlaya's original algorithm and describe our extension of it. We also give a brief 
overview of Monsky-Washnitzer cohomology and explain Kedlaya's reduction procedure on dif- 
ferentials which remains formally the same in the extended version. 

In Section 3, we consider our alternative (pseudo)-basis and give a proof of the integrality 
of the reduction of the image of p-Frobenius on its elements alongside an analysis of Kedlaya's 
original basis. We also give the short proof of the generalisation of the point-counting formula 
to even degree hyperelliptic models. 

Finally, in the last section we give proofs of the slightly more technical result relating the 
space spanned by our pseudo-basis to its image in Monsky-Washnitzer cohomology and giving 
the difference between the eigenvalues of Frobenius on these two spaces. 

Acknowledgements I would like to thank the referees for many useful suggestions. 
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2. Review of Kedlaya's Algorithm 

In this section we give a summary of Kedlaya's algorithm as it appears in |KedOl) as well as 
describing our extension of it. The basic notation introduced below will be used throughout the 
paper. 

Basic notation. 

Throughout, q := will denote a positive power of an odd prime p. k will denote the finite 
field Fq, unless otherwise indicated. R will denote W{k), the ring of integers of the unique 
unramified degree n extension of the local field Qp. dp will denote the p-Frobenius automorphism 
oi R ov K that reduces io a ^ aP on k. 

C will denote the hyperelliptic curve which is the projective normalisation of the smooth 
plane affine curve C\ with defining equation 

= Q{x) 

where Q{x) = adx'^ + . . . + oq is a separable polynomial of degree d in k[x\ . To simplify notation, 
we also use Q{x) to denote some arbitrary lift of Q{x) to R (i.e. a degree d polynomial over 
R such that reduction mod p of the coefficients gives Q{x)). It will always be clear from the 
context which polynomial is being referred to. 

We let g denote the genus of C, so that d = 2g + 1 ov d = 2g + 2. We refer to the d = 2g + 1 
case as the odd case and the d = 2g + 2 case as the even case. In the odd case C\Ci consists 
of a single A;-rational point, which is a Weierstrass point of C and will sometimes be referred 
to as oo. In the even degree case, C\Ci consists of a pair of non- Weierstrass points, ooi and 
c«2) which are either fe-rational or conjugate points over F^2. Computationally, it is easiest to 
transform the initial Q over k[x\ so that = 1 and the lift to R of a^i is also 1. This may involve 
working with the quadratic twist of C in the even case, but there is no problem converting back 
the final result (by substituting t ^ —tin the numerator of the zeta function). So from now on, 
we assume that ad is 1 and C has two A:-rational points at infinity in the even case. 

Following Kedlaya, we define C"" as the open affine subset of Ci given by inverting y; i.e. 
C"- = Spec{A]S) where 

Au:=k[x,y,y-^]/{y^ -Q{x)) 

and we will let Ar := R[x, y, y~^]/ (y^ — Q{x)) which is a finitely-generated, i?-smooth i?-algebra 
with Afi <SiR /c — Afc. C°' is just C with all Weierstrass points and points at infinity removed. 

Basic outline of the algorithm. 

Given an odd degree model of a hyperelliptic curve C over Fg as above, Kedlaya's algorithm 
computes the degree 2g monic polynomial L{X) that gives the numerator of the zeta-function 
of C [Cc{s) = L(g~*)/(1 — g'^*)(l — q^^^)]- The number of points on C, #C(Fgr), or the order 
of its Jacobian, # Jac(C)(Fgr), over any finite extension F^r of the base field can be simply 
computed from L{X) in the usual way (e.g. see Appendix C |Har77) ). 

The main stages are given in Algorithm 1. 
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Algorithm 1 Kedlaya's original algorithm 
Step 0: Input Q{x). 

Step 1: Working in VF(A;)[x][[l/y]], compute {1/y'^) to sufficiently large p-adic and (1/y)- 
adic precision by formally expanding 



x'^{dx/y),0 < i < d — 2 under p-Frobenius. 
Step 2: Reexpress the images of the differentials as W{k) ® Q-linear combinations of 
the differential basis using the RednA and RednB reduction processes described below. 
This results in a {2g)-hy-{2g) matrix M for the action of p-Frobenius to finite p-adic 
approximation. 

n— 1 

Step 3: By binary-powering or similar, compute the product N = MM'^ . . . M'^ and 
the characteristic polynomial Fp{X) of N . This is actually equal to L{X) G Z[X] but 
will have been determined here in Zp[X] to a large, finite p-adic precision. 

Step 4: Recover and return L{X) from the p-adic approximation in step 3, using the Weil 
bound to guarantee correct integer coefficients. 



Extension of the original algorithm. 

We adapt/extend the original algorithm in two ways. 

• Even degree models [d even) are allowed. 

• When p < 2g, d odd, ox p < g, d even, the differential pseudo-basis x^{dx/y^), < i < 
d — 2 is used rather than [dx / y) . 

The first change extends the algorithm to an arbitrary hyperelliptic curve (possibly after 
applying a quadratic twist as described earlier). 

The second change guarantees that we always work with a p-Probenius matrix M with p- 
integral coefficients. In the cases where we use the alternative differential basis, Kedlaya's 

original basis generally leads to a p-adically non-integral M. Strictly speaking, the alternative 
set of differential forms only form a basis for cohomology when d is odd. This is why we refer to 
it as a pseudo-basis. It still leads to correct results in the new algorithm. All of this, along with 
the justification for the new Step 4 below in the even degree case, is demonstrated in Sections 
3 and 4. 

The new algorithm is formally very similar to the original, so we will just state the changes 
that need to be made. 




This gives a finite approximation of the image of the differential basis of cohomology 



Steps 1 and 2. These are unaffected except that the expression to be formally expanded 
in step 1 has exponent —3/2 rather than —1/2 in the cases where the alternative differential 
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pseudo-basis is used. The matrix M in step 2 will be of size 2g + 1 rather than 2g when d is 
even. 

Step 4 Compute Li{X) from the p-adic approximation to Fp(X) coming from Step 3. If d is 
even then let L{X) = Li{X)/{X — q) if using the dx/y basis or L{X) = Li{X)/{X — 1) if using 
the dxjif' pseudo-basis. If d is odd, just let L{X) = Li(X). Return L{X). 

The linear factor that has to be removed in the even case comes from an extra eigenvalue 
of the action of Frobenius on cohomology (see Section 13. ip . That the factor is different for the 
pseudo-basis comes from the relation between it and an actual cohomology basis. The extra q 
eigenvalue is lost but a new eigenvalue 1 appears (see Section 4). 

In practice, only half of the coefficients of Fp{X) (those of the higher powers of X) need to 
be computed (because of the a -f-T- q/a symmetry of the algebraic roots of L(X)) and we can 
effectively remove the extra X — q or X — 1 factor from Fp{X) (rather than from Li(X) at 
the end) in the even degree case during these computations. The coefficients can be computed 
from the traces of the first g powers of N as a matrix over Zp. Removing the extra factors at 
this stage means that there is no necessity to increase the p-adic precision to which we need to 
know beyond the same lower bound used in the odd-degree case. This is determined from 
the upper bound for the size of the (top) coefficients of L(X) that comes from all of its roots 
(over C) having absolute value y^. Expressions in g and n for the p-adic precision needed in 
the initial series expansion computed in Step 1 are given near the end of Section 3. 

In the remainder of this section - which relates to Steps 1 and 2 - where we describe the 
Monsky-Washnitzer cohomology groups and the reduction procedures for Step 2, no distinction 
need be made between the even and odd degree cases except where indicated. 

That the differential reductions of Step 2 take p-Frobenius transforms of elements of the 
pseudo-basis back into linear combinations of such elements will be demonstrated in Lemma [3.41 

Monsky-Washnitzer Cohomology. |MW68j . |Mon68] . |Mon71] . 

Let X be a non-singular affine scheme over k. Monsky and Washnitzer defined a p-adic 
cohomology theory for such X with appropriate fixed-point theorems for proving zeta-function 
results. Kedlaya used this (originally at least) to provide the technical basis for his algorithm. 
Monsky-Washnitzer cohomology agrees with Berthelot's more general rigid cohomology in the 
affine case and is pleasantly explicit in its definition. We will need some of its properties for 
later proofs and so we give a brief description of the theory here. 

Let Ak temporarily represent the affine coordinate ring of our general X and An/R be a lift to 
an i?-smooth i?-algebra as above and Ak = A^ ®r K. 

Definition 2.1. Let Fq be the /c-linear Frobenius endomorphism Ak — s- A^ given by a i— )■ a'. 
Similarly, let Fp be the /c-semilinear endomorphism of A^, . 
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The goal is to define a good cohomology group which simulates de Rham cohomology of Ak 
and to which Fq lifts. Fg lifts to the p-adic completion, = lim^ Aji/p^Aji, but the de Rham 

cohomology of Ak = Ar f^ji K is usually bigger than that of Ak- Monsky-Washnitzer define a 
subalgcbra A^ of Ar, referred to as the weak completion, as follows. If i?-algebra 
generators of Ar then 

oo 

A^ := cinPnixi, • • • , Xr) ■ a„ G p^R, Pn of total degree < C(n + 1) for some C > 1} 

n=0 

and A^j^ = A^ ®r K. Up to isomorphism, is shown to be independant of the lift Ar and the 
generators xi. 

ri* t , is the separated ith differential module, the plain differential module of A^ divided 
out by the intersection n„p"f2^| and tensored with K. There is the usual differential complex 

the homology groups of which give the MW cohomology groups W [Ak ; K) . 

If Ak is of KruU dimension 1, as in our case, then X =0 for alH > 2 and so H\Ak]K) = 

il^ |. /(i(j4j^) and all higher cohomology is trivial. 

If Fq lifts to F on then F functorially induces a i^- linear automorphism of the i/* , which 
is independent of the choice of lift, and there is a cohomological trace formula for ^X(Fqm) for 
all m > 1 (see next section). Furthermore, if Fp lifts to a cr-semilinear map Fp : A^ ^ A\ then 
Fp induces a cr-semilinear automorphism Fp* of the W with = Fp^ . 



Now let Ak, Ar refer to the hyperelliptic algebras again. The inversion of y allows Kedlaya to 
define a hft of Fp to A^ by 

y^yP{l + '^ ^^W-LVWI- „-l„„-p„a. 1-1/2 



The congruence Q"'{xP) = Q{xY mod means that the standard power series expansions 

of (1 + . . .)^/^ and (1 + . . .)~^/^ converge to elements in A^^. 
In fact, Kedlaya gives the following explicit description of A^: 

A'^ = [y Sn{x)y'' : deg(5„) <d-l lim inf '"-^^ > lim inf '"J^^ > Q I 

k -oo ) 

where Vp{f ), f G R[x] is the smallest m such that / G p"^R[x]. 

The hyperelliptic involution co : x x, y^^ ^ —y^^ extends to A^ (and A^ (g)^ K) giving the 
direct sum decomposition 

A^ = Al®Al with 4 = {^W"}, ^l = {i;^2n+iy'"+'} 
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and a corresponding decomposition of H^{Ak;K) into + and — components. Kedlaya shows 
that the Monsky-Washnitzer trace formula leads to the result that the numerator of the zeta- 
function of C is just the characteristic polynomial of on when d is odd. We will show in 
Section 13.11 that the same analysis gives only a minor difference when d is even. 

Reduction steps in the computation of F^: 



Kedlaya shows that a K-hasis for the finite-dimensional {Ai^ ; K) is given by the Ak dif- 
ferentials 

{x'dx/y : < i < d - 2} U {x'dx/y^ : < i < d - 1} 

the first set giving a basis for H}_ and the second for H^. We come back to this in the next 
section where we note that it also holds for d even. 

The first stage of the algorithm consists of expanding the series for Fp^,{l/y) to sufficient 
p-adic precision. We will give a precise value for the precision required at the end of Section 3. 

The second stage consists of applying two types of reduction to reexpress these images as 
JT-linear combinations of basis elements. The two basic relations are 

= Q{x) and dy = {Q' {x)/2y)dx 

where the prime denotes the standard derivative. 

As Q and Q' are relatively prime in k[x], there exist U,V £ R[x] such that UQ + VQ' is 1. 
Therefore, for any 5 G R[x], there exist A,B £ R[x] with S = AQ + BQ'. Then, for m ^ 2, 

S^ = A^ + 2B^ = A^+(^]B'^-(^]d^ 



ym ym—2 y'lri—l ym—2 \ 77J 2 / ym—2 \ 772 2 J \ym—2 

This gives the first reduction type: 

,dx / . / 2 \ „,\ dx 



RednA 



to reduce m by 2 when m> 2. Note that in practice, we only apply this for deg(S') < d because 
we begin by recursively dividing S hy Q (which is monic) to express S as Sq + SiQ + S2Q'^ + ■ ■ ■ 
with Si G R[x\, deg(S'j) < d and then replace Q* by y^*. In fact, we only divide out by Q 
and replace by while this leads to negative powers of y in the expression. Note also that if 
deg(5) < d (in fact, if deg(5) < 2d — 1), then A and B can be chosen as SU mod Q' and SV 
mod Q, so with deg(^) < d — 1 and deg(S) < d. 

In this way, RednA applied recursively reduces S{dx/y"^) to a T{dx/y) or T{dx/y'^) depending 
on the parity of m. Note also, that if the initial m was < 0, then we could shift up instead by 
replacing a positive power y^* by Q*, but this case doesn't occur. 

The second reduction uses the differential equalities (for r > 0) 

diyx') = rx'^^dx = rx^^^Q{x){dx/y'^) leading term rx'^^'^^^ 
d{2x''y) = [2rx''~^Q{x) + x''Q'{x)]{dx/y) leading term (2r + d)x'"+'^-^ 
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Subtracting multiples of the right hand sides of these from T{dx/y'^) or T{dx/y), reduces the 
degree of T until we are back to linear combinations of basis elements. This will be referred to 
as RednB. 

Applying a number of RednA followed by a number of RednB steps thus reduces any S{dx/y"^) 
to a linear combination of basis elements. The reductions can clearly introduce a power of p 
into the denominator of the final expression. This should be accurately estimated in order to 
gauge a priori what the loss of p-adic precision may be and if there will be non-integral terms 
at the end. We give the analysis in Section 3. 

Stages 1 and 2 of the algorithm give an explicit (d — l)-hy-(d — 1) matrix M over R which 
represents the cr-linear transformation Fp* on H}_ with respect to the chosen x^{dx/y) basis. 
Computationally, the entries of M will be finite approximations of the exact values which are 
correct mod p^ for some depending on the p-adic precision that we carried out the stage 1 
expansion to and on the loss of precision in stage 2. The final stage is to compute the nth 
twisted power of M: Af^" ^M*^" ^ . . . M. This gives the matrix of F^, on Hl_ and we just need 
its characteristic polynomial, Ppit). 

If M is integral, Ppit) will be correct mod p^ and the Weil bound tells us how large A'^ should 
be taken for this to determine the numerator of the zeta function of C. If M is non-integral, it is 
hard to give good small estimates of the p-adic precision lost in the twisted powering. Therefore, 
it is highly desirable to have a p- integral M. As we show in Section 3, for small p, the x^{dx/y) 
basis will usually lead to M with denominators whereas the x^{dx/y^) pseudo-basis never does. 

3. Adaptation of the basic algorithm 

In this section we describe in detail the adaptations to Kedlaya's algorithm outlined in the 
introduction and previous section, and provide proofs of correctness. 

3.1. Zeta function formula: even or odd case. 

Let Pc{t) be the numerator of the zeta-function of C/k (see, eg, App. C, [Har77] ). The 
polynomial Pcii) = + C2g-it^^~^ -|- . . . + cq, a monic polynomial over Z. Its roots over C, 
{aj}, all have absolute value q^^"^ and this set is invariant under a i— t- q/a. Furthermore, if 
Sr (a) = a\ + . . . + then 

#C7(Fg.) = / + 1 - Sr{a) Vr > 1 

Lemma 3.1. The characteristic polynomial of F^, acting K-linearly on H^{Ai^;K)^ is Pcif) 
when d is odd, and is {t — q)Pc{t) when d is even. 

Proof. The following argument is from [KedOlj when d is odd. From the explicit description of 
A\ it follows immediately that, if = k[x]Q and Bfj = R[x]q, then Fp lifts to as a cr-linear 
map with x i— )• and 

4 ^ and Ql,^^ 
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as Fp-modules. Thus (abbreviating H^{Ak; K) to and using subscripts for the ± eigenspaces) , 
= and H}^_ are F*-isomorphic to the cohomology groups for Spec{B}.). This is isomorphic 
to := IP^\5', where S is the set of finite places corresponding to the irreducible factors of 
Q ^ k[x\ and the point at infinity. 

Essentially, the contribution to cohomology resulting from the removal of closed points from 
C to get to C" is precisely matched by the removal of the corresponding points from in 
the odd case and gives the component. When d is even, as well as the Weierstrass points, 
we are removing 2 /c-rational points from C at infinity which are swapped by the hyperelliptic 
involution and lie over a single /c-rational point of P^. This leads to an extra eigenvalue q in 
each of the + and — components of H^. Formally, this follows easily from the trace formula as 
we now show. 

The fixed-point theorem for Monsky-Washnitzer cohomology gives the following trace formula 
for a general affine X/k of dimension n with (finite-dimensional) cohomology groups 

n 

#X(F,-) = J](-l)^TVacei,((g'^F-i)n//*) Vr > 1 

i=0 

Let A^r- = the number of roots of Q{x) over F^r and (5 = if d is odd and 1 if d is even. The 
MW trace formula for and P*^ and Weil formula for #C(Fgr) give 

(C'^) q^-Sria)-Nr-6 = Tr((gF-ir|//°)-Tr((<?F-ir|//|)-Tr((gF-ir|^l) 
(n Q'-Nr = TT{{qF-'Y\H^)-Tri{qF-'Y\Hl) 

Subtracting gives 

TiUqF-^YlHl) = Sria) + 6 Vr > 1 
which implies that the eigenvalues of qF^^ on H}_ are {ai}[U{l}]rfei)en- Hence, the eigenvalues 
of are {ai}[U{q}]deven- 

Therefore the characteristic polynomial of on Hi is Pc{t), if d is odd, or {t - q)Pc{t), if 
d is even. □ 

3.2. Differential basis choices. 

We first note that Kedlaya's assertion that {x'^dx/y :0<z<d — 2}U {x'''dx/y^ : < i < d — 1} 
form a basis for remains true for d even. 

By Thm. 5.6 of |M W68j . the natural map HlpJ^C^/K) -f H^{Ak]K) is an isomorphism, 
where Ck,C'^ are the hyperelliptic lifts of C, C"" to K corresponding to the lift of Q{x). The 
reductions RednA and RednB on algebraic differentials show that the above set of differentials 
generate H^^{C1^/K) and a similar argument shows that no nontrivial i^-linear sum of them 
is of the form df for / G K[x,y,y~^\/{y'^ — Q{x)) [Note: any element of this algebra is a finite 
sum of the form '}2,n=f) '^n{x)y^"'] 

Remark. That the given differentials form a basis also follows easily from general de Rham theory 
for complete curves and their open afhne subsets applied to H^^{Ck/K) and H^^{C'^/K). 



AN EXTENSION OF KEDLAYA'S ALGORITHM FOR HYPERELLIPTIC CURVES. 



11 



Definition 3.2. We define two sets of differentials, Bi and -62- 

Bi = {dx/y,x{dx/y), . . . , x'^'^idx/y)} 

B2 = {dx/y^,x{dx/y^), . . . , x'^''^ {dx / y^)} 

Tlie classes of the differentials in Bi give a basis for H^. B2 is our pseudo-basis whose classes 
only give a basis for Hl_ when d is odd, as we shall see. 

For convenience, we also define V2 as the {d — l)-dimensional i^-vector subspace oi Cl^ ^ 

with basis B2 and r/ as the class map into 

ri:V2^Hl_ x'-\dx/y^) ^ [x'-\dx/y^)] 

Lemma 3.3. 

(i) (Kedlaya) Let m > 2, S £ R[x] with deg{S) < d — 1. Under RednA, let 
S{dx/y^) = T{x){{dx/y) m odd , {dx/y'^) m even} T{x) G K[x], deg{T) < d 

(ii) Let S G R[x] with deg{S) = m > d — 1. Under RednB let 

S{dx/y) = T{x){dx/y) T{x) G K[x\, deg{T) <d-l 

then p[^oS,{2m-d+2)\ J, ^ jj^ g^g^^ ^[log^(m-(d/2)+l)J j, ^ 

In either case, the d{Y^^^ Sr{x)y^) differential giving the reduction can be chosen with p'^Sr{x) G 
R[x] Vr for the same p^. 

Proof, i) is just Lemma 2 of [KedOlj . Note that in the statement of that Lemma, logp(2m + 1) 
should be replaced by logp(2m — 1) (with m > 1) and in the proof, every itm as the upper or 
lower limit of a sum should be replaced by ib(m — 1). The proof of the lemma works just as well 
for d even or odd and the final statement about Sr{x)y^) above is what is actually proven 

in Lemma 2. 

ii) This is essentially Lemma 3 of jKedOlj (or rather the corrected statement in the errata. 



[Ked03]). As Kedlaya notes, ii) and the statement about d{Y^^ Sr{x)y^) follow in the same 
way as part i) (but more easily). We have that S{dx/y) — d{YlT=o^~^ "^^rX^y) ~ '^(d^/y), 
d{2x^y) = ((d + 2r)x'^^^~^ + . . .){dx/y) and the coefficient of x** in T is zero for s > d — 1. 
Kedlaya's argument - considering formal expansions of the differentials with respect to a local 
parameter at one of the points at infinity - effectively shows that the largest power of p that 
may occur in denominators is the largest power of p that can divide one of the d + 2r (rather 
than their product). When d is even, it is only necessary to consider divisibility of {d/2) + r 
since p is odd. □ 



Any element of Q\ can be written uniquely in the form X]-oo Sn{x)y^dx with deg(S'„) < d, 
which we refer to as its standard expansion. 
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Lemma 3.4. 

(i) For all uj G B2, the standard expansion of Fp^oj is of the form Y2n>3'^'nix){dx/y^''). 

(ii) RednA on the Y2n>i ^n{x){dx/y^) part of the standard expansion of Fp^{x^{dx/y)) (resp. 
Fp^{x^{dx/y^))) gives a form which is a linear combination of elements of Bi (resp. B2) 
with p-integral coefficients. 

(iii) Consider the coefficients of the Bi expansion resulting from RednB on the Yln>i Sn{x)y^dx 
part of the standard expansion of Fp^{x'^^^{dx/y)). 

(a) If d = 2g + 1, then these coefficients are p-integral for i < g and for i = g + r have 
denominator hounded by p^L^°Sp(2r-i)J _ 

(b) If d = 2g + 2, then these coefficients are p-integral for i < g-\-l and for i = g-\-r-\-l 
have denominator bounded by 

By part (i), we can use RednA to reduce Fp^,uj back to linear combinations of elements in B2 
rather than descending to Bi. This is what is meant in part (ii). In this way, we get a cTp-linear 
map (also denoted Fp:^) V2 ^ V2. 

Proof. We have, for l<i<d — 1, A; = Oorl, 

Fp,{x^-Hdx/y''+')) = x?'(-i)y-(2^+i)P (l + p y-2py^^'+'^/^ ^(^p) 



p^''-' {E,nodd>i2k+i)pP^'^^~' bUx)y-'^) dx 



with ai{x),bi{x) £ R[x] of degree less than d. Note that b(^2k+i)p{x) = 1 that {. . when 
expanded is then reduced to the form Ai{x)y~'^ + . . . + Apn{x)y~'^P"' with Ai{x) G R[x] of degree 
less than d. 

When we multiply each term in the final sum by x^~^ and reduce using the relation y'^ = Q{x), 
we see that the result is 

Fp.{x^-\dx/y''+')) = EmoM>mo^rn{x)y~^dx 

where 

mo> {2k + l)p-2[{pi-l)/d\ (1) 

and each Cm{x) G pR[x]. Here we have used b(^2k+i)p{x) = 1 to get pi — 1 rather than pi + d — 2. 
Furthermore, 

Cm{x)ep\ 2f r R[x] \/m>{2k + l)p (2) 
(i) When A; = 1, by ([I]) with z = d - 1, mo > p + 2 > 3. 
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(ii) First note that for m < (2k + l)p < p^, logp(m — 2) < 2. From Lemma 13.31 and ([2]), we 
see that it suffices to prove that 

+ l-k- [logp{m - 2)J > Vm odd > {2k + l)p 

For k = 0, the inequahty with the floor and ceiUng brackets removed holds for m > 2p + 1 by 
elementary calculus. For p < m < 2p + 1, it is clear. 

For k = 1 and p > 5, the inequality again holds for m > 5p hy calculus and for 3p < m < 5p 
it is clear. 

For k = 1 and p = 3, the inequality holds for m > Sp"^ + 1 by calculus and for 3p < m < 3p^ + 1 
it is again easy to check directly. 

(iii) Consider the pxP'^^^p'^bm{x)y~^ terms that give contributions to the Yln>i sum. Ex- 
pressing x'P^~^bm{x) as Ur{x)y'^''" + . . . uq{x) with deg(tij) < d, we must have r > (m — 1)/2 and the 
contribution will be expressible in the form S{dx/y) with deg(5') = pz — l + deg(6m) — d(m — 1)/2. 
This last expression must be greater than or equal to d—\ for non-trivial reduction under RednB. 
For such m, writing dm for deg(6m)j the above and Lemma 13.31 (ii) show that the power of p in 
the denominator of the RednB reduction of the contribution from the index m term is bounded 
above by 

[logp(2pi -md + 2dm)\ - I - \{m - p) /2p] if d = 2^ + 1 

Llogp(pi - m{d/2) + d„ + 1)J - 1 - \{m - p)l2p~\ iid=2g + 2 

We have that dp = {bp{x) = 1) and dm < d — I ioi m > p + 2. Since m > is odd, the 
above expressions are maximal when m = p. (a) and (b) follow easily from this. □ 

The bounds in Lemma 13.41 (iii) for denominators in the reduction of Fp^{x'^~^{dx/y)) are 
sharp. The proof shows that the first term in the power series expansion px^'^^^ {dx / y^) is the 
only one that can contribute to the given maximal power of p and for a general Q it does indeed 
lead to denominators equal to the bounds. 

Thus, as is readily confirmed in practice by computer computations, we reach the following 

Conclusion: When d = 2g + l and p > 2g—l or d = 2g + 2 and p > g, the transformation matrix 
M for Fp^ w.r.t. basis Bi for is p-integral. When these equalities for p do not hold however, 
for a general Q, entries in the lower rows of M have powers of p in the denominator given by 
the bounds in the last part of Lemma 13.41 

On the other hand. Lemma 13.41 shows that RednA applied to Fp^(uj) for lo & B2 reduces back 
to an expression that is always an i?-linear combination of the elements of B2, so formally leads 
to a p-integral transformation matrix M. 

If B2 gives a basis for //I, then this M genuinely represents Fp^ on that space and B2 can 
replace Bi as the chosen basis for computations. 

Even when B2 doesn't give a basis, this M can still be used. The above shows that the kernel 
of 7] and its image in i^i are Fp*- and hence also F*-stable. 



m — p 
2p 
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The following result will be demonstrated in the next section. 
Proposition 3.5. 

(i) rj is an isomorphism when d = 2g + 1 but has a 1-dimensional kernel and cokernel when 
d=2g + 2. 

(ii) In the latter case, -F* is the identity on ker(?7) and acts as multiplication by q on 
Hi/Im{r]). 

This justifies the adaptation of Kedlaya's algorithm given in Section 2, which always works 
with a p-integral M. In summary: 

New Algorithm 

• d = 2g + 1. p > 2g then the algorithm is unchanged, p < 2g then the algorithm is 
as before, but use differential basis B2 instead of Bi. 

• d = 2g + 2, p > g. Apply the algorithm as for odd d with differential basis Bi. At the 
end, remove a factor t — q from the characteristic polynomial of F*. 

• d = 2g + 2, p < g. Formally apply the algorithm as for odd d with pseudo-basis B2- At 
the end, remove a factor t — 1 from the characteristic polynomial of F^,. 

Efficiency If Ni = \{ng/2) + logp{2(^^))] {q = p") and iV = iVi + [logp(2iVi)J + 1, then esti- 
mates using Lemma [33] and the Weil bound show that it suffices to compute (1 -|- {Q'^{xP) — 
to accuracy in order that M is of sufficient p-adic accuracy to deter- 
mine Pc{t)- Here, A; = if we use Bi and k = 1 for B2. Using k = I rather than A; = makes 
virtually no difference in computational efficiency here, and the reduction of Fp^:(u}) back to a 
linear combination of basis elements is in fact slightly better when using B2 ■ 

However, d = 2g + 2 rather than 2g + 1 does increase the size of the bases by 1 element, 
meaning that one extra reduction of a Fp*(a;) has to be performed. Also the (d — 1) x (d — 1) 
matrix M, which has to be a-powered to the nth power, has an extra row and column. This does 
make a small difference (more so for smaller g), which makes it worth looking for a fc-rational 
root of Q{x) and moving that to 00 to transform to ci = 2^ + 1. In general, though, no such 
transformation is possible. 



4. Proof of Proposition 13.51 
Proposition 13.51 of the last section on the 77 map is proven in the following three lemmas. 

Lemma 4.1. If d = 2g + 1 then rj is an isomorphism onto H\. 

If d = 2g + 2 then r/ has a one dimensional kernel generated by V{dx/y^) = d{—2S/y) where 
V = SQ' — 2S'Q and S = x^~^^ + . . . S K[x] is the unique monic degree g + 1 polynomial such 
that V is of degree < 2g. 
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Proof. Using the fact that Bi is a basis for H_ and the RednA formula, we see that an element 
of the kernel of r] corresponds to a differential of the form V{dx/y^) with deg{V) < d — 2 and 
V = SQ' - 2S'Q. 

UV = Orx" + . . . with r > 0, / 0, then the leading term of SQ' - 2S'Q is {d-2r)arx'^+''-^ , 
so d must equal 2r. So, d = 2g -\-2 and r = g + 1. Normalising S so that its leading coefficient 
is 1, it follows easily that its lower coefficients are completely determined by the condition on 
deg(y). Explicitly, if bi is the coefficient of in S, then the condition that the coefficient of 
^d+i-i gQi _ 2S'Q is zero, < i < 5, translates into 

{2g + 2 — 2i)bi = some linear combination of bj,j > i + 1 

This determines the bi inductively and gives a unique S and V up to i^T-scaling. □ 



Lemma 4.2. When d = 2g + 2, acts trivially on ker(?7). 

Proof. From the last lemma, ker(77) is 1-dimensional and generated by a; = V{dx/y^) = d{—2S/y) 
with S = x^^^ + . . . . As ker(r/) is F^^-stable, oj is an eigenvector for with eigenvalue A, say. 
We must show that A = 1. 

Considering the images in and using Lemma 13.41 (ii) , we get 

^(r)=^frVf§ + §...')^(4-r (3) 



yv J \yj / 

In fact, this equality is true up to addition of a constant in K, but as both sides are in the — 
eigenspace, the constant must be zero. The Bi here have degree < d. 

Now, as in the proof of Lemma [3.41 we see that if the standard expansion of / S ^4^^ is of the 
form X^„>3 an(3;)/y"i then Fp{f) has the same property. 

Also, expanding S{xP) as Ur{x)Q{xY + . . . + uo{x) = Ur{x)y'^^ + . . . + uq{x) with deg(iij) < d, 
we easily get that r = (p — l)/2 and Ur{x) = x^^^ + . . . . 

Then, using Fp{l/y) = y^^{l + a2{x)/y'^ + a4{x)/y'^ + ■■■), we find that Fp{S/y) = Si{x)/y + 
b^^x) / y^ + . . . with Si{x) = x^^^ + . . .. Iterating, we see that the same holds for F{S/y). Then, 
([3]) implies that A = 1. □ 



Lemma 4.3. When d = 2g + 2, F^ acts on H\/ Im{rj) as multiplication by q. 

Proof. We already know that Im(r/) is an F*-stable codimension 1 subspace of and that the 
eigenvalues of F^, on H}_ are q and the roots of Pcit), the numerator of the zeta- function of C. 
We need to show that the eigenvalues of F^, on Im(r/) are precisely these latter roots. 

We will prove the lemma by using an isomorphism to an odd degree model over an extension 
Fqr of k where Q G k[x] has a root. In fact, replacing F by F^ corresponds to replacing the 
basefield k = F'^ hy ki = F'^ and the roots of Pc/ki (t) the rth powers of the roots of Pc/k{t)- 
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These latter roots have absolute value (fl"^ in every complex embedding whereas (f obviously 
has absolute value (f . So we can assume that Q has a root in k. 

First note that 

Im(?7) = {w G li\ I Residueooi(w) = Residueoo2 (^) = 0} 

as both sides of the equality have codimension 1 in }i\ and the LHS lies in the RHS (in fact, 
all differentials of the form x'^{dx/y'^), i < d — 2 are holomorphic at both points at infinity). 

We can translate a root of Q{x) to zero by a x i— )• x — a translation (this changes the lift of 
F but not lm{r])), so assume that Q{x) = x^S'+s _|_ a2g+ix'^^'^^ + . . . + aix G k[X], ai / 0. 
Let QiX) = + (a2/af)X2a + . . . + {l/al'+^). 

The equation = Q{X) defines a new smooth, odd-degree affine model for C and we have 

(Y^-QiX)) {y^-Q{X)) ' 

[note: l/(aix) = (l/(ai7/^))(ai + a2X + . . .) G A]^]. Letting B'^ be the smooth lift of corre- 
sponding to the lift to R[X] of Q with the coefficient lift compatible with that of Q, we get the 
corresponding commutative diagram 

5t y 



y 

for some choice of (/-Frobenius lifts F^^^ and F^"^^ . All maps commute with the automorphisms 
induced by the hyperelliptic involution. 

One easily sees that A/^ = The Main Theorem of |Mon68 ] implies that 

H\Bk;K)^ H\Ak;K) = H^ 

with image the i^-subspace of elements with residues at c«i and oo2) the images of points with 
X = under the automorphism of C induced from i?^. M> A^.. [In fact, a bit of computation 
verifies the residue condition directly from the explicit maps]. 

Thus lm{H^{Bk;K)-) = lm{r]) and as we know that the eigenvalues of F^ on {B^ ; K) 
are the roots of Pc{i) (the odd degree case), the result follows. □ 
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